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We discuss several methods for unambiguous state discrim- 
ination of A'' symmetric coherent states using linear optics and 
photodetectors. One type of measurements is shown to be op- 
timal in the limit of small photon numbers for any A'^. For the 
special case of A'^ = 4 this measurement can be fruitfully used 
by the receiving end (Bob) in an implementation of the BB84 
quantum key distribution protocol using faint laser pulses. In 
particular, if Bob detects only a single photon the procedure 
is equivalent to the standard measurement that he would have 
to perform in a single-photon implementation of BB84, if he 
detects two photons Bob will unambiguously know the bit 
sent to him in 50% of the cases without having to exchange 
basis information, and if three photons are detected. Bob will 
know unambiguously which quantum state was sent. 



I. INTRODUCTION 

The simple fact that nonorthogonal quantum states 
cannot be perfectly distinguished lies at the basis of 
Quantum Cryptography and Quantum Key Distribution 
(QKD): An eavesdropper is not able to determine with 
100% certainty which quantum state was sent if the alter- 
natives were chosen from a nonorthogonal set of states. 
Among the various strategies the eavesdropper might use 
to gather at least some information are measurements 
that maximize her probability of guessing the state cor- 
rectly. Alternatively, she might decide to perform a mea- 
surement that allows her with some nonzero probability 
to learn unambiguously which state was sent, at the cost 
of sometimes getting an inconclusive result. The con- 
cept underlying this type of measurements, unambiguous 
state discrimination (USD), was first introduced for the 
case of two nonorthogonal states by Ivanovic in 1987 ||] 
and a bound on the maxium achievable success probabil- 
ity was found shortly afterwards B], 
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if \4>o) and are the two states to be distinguished. 

In general, a USD measurement with a nonzero proba- 
bility to succeed exists for any number of states provided 
they are linearly independent j^. For the special case 
of sets of N symmetric states, i.e., states {\ipi)}i=i...N 
that can be written as {U^~^\tpi)}i=i...N for some fixed 
unitary operation U such that U^\iIji) = \tpi), the op- 
timum USD probabilities were found in [Q. Eavesdrop- 
ping attacks using such USD measurements were anal- 
ysed in and USD experiments on polarization were 



reported on in |Q . Here we will consider linear optics im- 
plementations of USD measurements on symmetric co- 
herent states. In particular, we show that even without 
entangled measurements and Quantum Non-Demolition 
(QND) measurements a USD measurement with near- 
optimum success probablity is possible using just beam- 
splitters, photodetectors and feedback. 

The motivation for this is as follows: In virtually all 
experimental implementations of the BB84 protocol ||] 
the signal states are weak laser pulses (see for instance 
0) rather than the single photons envisaged in the orig- 
inal protocol. One disadvantage is that an eavesdropper 
may exploit the presence of multiple photons in some of 
the signals to gain more information and/or remain un- 
detected, as has been discussed in several papers Q . We 
show here how the legitimite users too can in fact make 
use of multiple photons by improving upon the standard 
measurement that is used in current implementations, 
which indeed is tailored for the singic-photon implemen- 
tation. If the quantum information is encoded in the 
phase of the signal a strong reference pulse is needed to 
provide a phase reference. The quantum states sent may 
then be assumed to be pure coherent states (relative to 
the reference pulse, see pT[|) with known amplitude a 
(assumed to be real) but unknown phases that may take 
one of four possible values, 0, 7r/2, tt, 37r/2. As pointed 
out in 1^], if polarization is used instead of phase, the 
signal states are mixed states, not coherent states. Yet, 
as detailed below, an important part of the following ap- 
plies to both polarization and phase encoding. 

In Section |l| we formulate the problem solved in this 
paper. In Section [II we discuss the solutions for USD of 
N symmetric coherent states for iV = 2,3,4 and TV > 4 
separately. The most detailed exposition is given for the 
case iV = 4, the case that applies to QKD. 



II. FORMULATION OF THE PROBLEM 

Suppose one has one copy of a coherent state |ae*"^) 
with known amplitude a but an unknown phase that 
may have one of N values, (pk — 2-Kk/N with k — 
0, 1 . . . [N — 1). The task is to unambiguously discrim- 
inate between these N values. Since the set of states 
||Q,g«0fc) = 0,1,... (iV — 1)} is linearly independent 
there are in principle measurements possible that al- 
low one to accomplish unambiguous state discrimination 
(USD) with some nonzero probability. An optimum pro- 



tocol and the corresponding maximum probabilities Pj 
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have been derived in Q : Defining probability amplitudes 
|cfc|2 for fc = 0. ..iV- 1 by 
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P^^-* is determined by the smallest of these amplitudes, 
according to 



(TV) 
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The question considered here is what USD probability 
^BS^ can one reach while using just beamsplitters, pho- 
todetectors, feedback and the ability to produce known 
coherent states of any amplitude? 

To be more precise, we allow the following operations 
and measurements: 

1. Unitary operations: take two coherent states |/3) 
and 1 7) (that may be known or derived from the 
initial unkown state jae*"^)) and split them on a 
beamsplitter to get two new coherent states as out- 
put modes, with amplitudes + and rP + tj, in 
terms of the transmission and reflection coefficients 

r of the beamsplitter. 

2. Measurements: take a coherent output state and 
measure whether it contains photons or not, with 
a photodetector of efficiency 77. 

3. Feedback: some of the light may be split off to 
a delay line so that subsequent measurements and 
unitary operations may depend on previous mea- 
surement outcomes. 

Neither Quantum-Non-Demolition (QND) measurements 
nor entangled measurements are considered here, as those 
are far more difficult to perform with present-day tech- 
nology. 



III. RESULTS 
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which depends on the actual (unknown) phase 0. We 
included here the quantum efficiency 77, defined as the 
probability of the photodetector to detect the presence 
of a photon. The effect of a finite efficiency is simply to 
effectively reduce the amplitude of the coherent state a 
by a factor y^. In the following we present results for 
perfect photodetectors only and the results for imperfect 
photodetectors can be obtained by subsituting a ^Jf\a. 



B. AT = 2 

This case is straightforward and known. It basically is 
a measurement in a particular "basis" specified by two 
phase values tt apart. Take the state |ae*"^) and put it on 
a 50/50 beamsplitter (i.e., t = 1/^/2 and r = z/\/2) with 
the state \ia), such that the two output modes are coher- 
ent states with amplitudes |Q;(e"^± l)/\/2), and measure 
photons on both outputs. Since is cither or tt the 
probability to detect a photon is in one output mode, 
and 1 — e^^l"!' in the other. If a photon is detected one 
can eliminate one of the two possible values of 0, and 
thus the probability of USD with beamsplitters is 



-2|a|' 
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which is in fact equal to the optimum value . 

Alternatively one could use the phase elimination 
scheme from Section III A to find the same optimum 



value. In fact, applying that method allows one to per- 
form an optimal USD on two coherent states with arbi- 
trary phases 0o a-nd (jji. Namely, split the original un- 
known state in two equal parts |ae*'^/-\/2) and perform 
the two elimination measurements to eliminate (j)o or 0i . 
The probability to eliminate one of the two is 



p(2«) _ 1 „-|ap|e'*0_e**i|V2 

^BS — e , 
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which is optimal and which reduces to (o) for <j)Q = (pi+ir. 



A. Eliminating one phase value 



C. N 



A primitive to be used later on is a simple beamsplitter 
setup that allows one with a finite probability to elimi- 
nate one particular value of the phase of a coherent state 
with known amplitude. Take the state jae*"^) with un- 
known phase and combine it on a beamsplitter with the 
known coherent state |/3e*"^°) with /3 — —t/ra and (f)Q the 
phase we wish to eliminate. By taking the limit of t — s- 1 
and r — > one will get (besides a useless output that is 



discarded) a coherent state |a(e 



ai4>0 



)). (Note this 



corresponds to a displacement operation.) If a photon is 
detected in this state </> cannot have the value (/)o. The 
probability of such a detection event is 



In order to analyse the case iV = 3 we first consider a 
simple USD set-up with a reasonably high probability of 
success. First split the original unknown coherent state 
into 3 identical copies jae"'' /VS). Then use each of these 
three states in a phase elimination measurement setup of 
the type discussed in Section pl A[ With the help of (Q) 
the probability to eliminate two out of three phases is 



P(^i = (l-e-'"' 
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k,l. This function is plotted in Fig. |^. 



3 for all 3 possible pairs of different 
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One can improve upon this simple strategy by split- 
ting the state into many small-amplitude coherent states 
and trying to eliminate one of the phases first, and then 
use the optimal method to distinguish the remaining two 
possibilities. So, first make M copies (with M ^ oo) oi 
the state \ae'^'^ / ^/M) . Then keep feeding copies in the 
three phase elimination setups until one of them gives a 
positive result. Subsequently use the rest of the light to 
elinate the last phase. The probability of success is 

M/3 

Pfs = Jm ^ 2e-6'=l"l'/*^ (l - e-3l"lVM^ 

k=0 

X ^1 _ g-3|a|^(l-3fe/Af)/2^ 

^l + 3e-2|"l^_4e-3l"l'/2. (g) 

The first line gives the probability to produce a photode- 
tection event after the fcth try in one of the two photode- 
tectors that possibly could click, the second line gives the 
probability of USD between the two remaining phases 
tt/2 apart, with the light remaining at that point, with 

intensity |q;P(1 — Sk/M). The function Pgg is plotted in 

Fig. Il| along with pj^^ as a function of photon number 
lap. 



D. iV = 4 

The case of = 4 symmetric coherent states is partic- 
ularly relevant for QKD: As mentioned in the Introduc- 
tion the 4 signal states in standard implementations of 
the BB84 protocol [|j using phase encoding are symmet- 
ric coherent states. Because of its relevance we describe 
the measurement in more detail. 

But first, we consider the simple scheme for the case 
N = A consisting of splitting the coherent state into 4 
equal parts |ae*'^)/2 and feeding these 4 states into 4 
phase elimination setups. The probability to detect pho- 
tons in 3 of those measurements is 

Plf) = (l-e-HVf (l-e-H^), (9) 

which is plotted in Fig. ||. 

The full measurement procedure that can be used in 
BB84 and that generalizes the near-optimum measure- 
ment from the preceding subsection, consists of 4 steps: 

1. Split the original state into M copies of the state 
|ae*'^/-\/M). The optimum procedure requires tak- 
ing the limit M ^ oo but any large value of M will 
be sufficient in practice. 




FIG. 1. USD for A'^ = 3 symmetric coherent states. The 
solid curve gives the optimum success probability ^ the 
dotted curve corresponds to a simple beamsplitter measure- 
ment Pgg, and the dashed curve describes a more complicated 

(3) 

version of the beamsplitter setup Pgg- 

For small amplitudes a the minimum coefficient deter- 
mining the optimum USD probability according to (|^) is 



always |cjv-i|^. For = 3 wc get P^^^ « 3|a|'*/2, 
comparing this to Pgg « 3|a|'*/2 shows our beamsplitter 
scheme is in fact optimal for small photon numbers, but 
the simple scheme only reaches P^g « |a|'^. 
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2. Choo se randomly one of two "bases" (as in Section 
niB), either (f> — 0,Tr or (j) — 7r/2,37r/2, and per- 
form phase measurements in the chosen basis on 
the subsequent copies until a photon is detected. 
The probability to detect a photon in exactly k + 1 
out of a possible M tries is 



Pi 



(fc) 
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The total probability to succeed in finding a photon 
is 



Pi = 1 - e 



(11) 



This probability is larger than the probability for a 
photon to be found in the original signal state, sim- 
ply because the measurement procedure itself dou- 
bles the number of photons on average. If one in- 
sists on using classical intuition, however, it is sur- 
prising that in half of the cases the receiver manages 
to measure the phase setting used by the sender no 
photons would have been found in the signal state. 

If a photon was detected in one basis in the previ- 
ous step, then perform phase measurements in the 
other basis on the remaining copies until a photon is 
detected. If in the previous step exactly k+1 copies 
were used, the probability to detect a photon after 
exactly m + 1 out of the remaining M — k — 1 tries 
is 



P^'"' = e 



(12) 
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The total probability to detect at least 2 photons 
in total (one in this step, one in the previous) is 

M-l 

X(l - g-2(M-fc-l)aVM^ 

In the limit of M — > oo this reduces to 

P2^1-e-^°'^ ~2a^e'^°'\ (14) 

For small a, P2 ~ 2q!*, which is larger by a factor 
of 4 than the probability to find at least 2 photons 
in the original state for small a. With 50% proba- 
bility the classical bit values corresponding to the 
two outcomes obtained in this and the previous step 
will coincide. In that case, Bob knows which classi- 
cal bit Alice sent without having to exchange basis 
information (in this sense this is like the B92 pro- 
tocol and as such probably secure). If the two 
classical bit values obtained by Bob are different, 
then only Alice will have to reveal what basis she 
used for Bob to know what state Alice had sent. Of 
course if in such a case the eavesdropper detected 
two photons as well, this would not be secure. How- 
ever, the fact that Bob detected 2 photons does not 
imply that Eve detected two photons. 

4. If a photon was detected in the previous step, take 
the remainder of the light and feed equal amounts 
in two phase elimination setups corresponding to 
the two remaining phases. The probability to de- 
tect another photon, and thus to unambiguously 
determine the quantum state, is 

p^^^_g-(M-fc-m)aVM^ (15) 

The total USD probability is then 

Af-l 
k=0 

m=0 

X(l _ e^H''ii-ik+l)/M-im+l)/M)^^ (--^g^ 

which in the limit M — > oo simplifies to 

P^'i ^ 1 + 3e-2|-l^ + 2|a|2e-2|a|^ _ _ (^^^ 

This function is plotted in Fig. || together with the 
optimum P^"^ as a function of photon number |ap. 
For small |ap, the more complicated scheme is op- 
timal, Pgg ~ 2|a|^/3, but the simple scheme only 
reaches « |a|V4- 




FIG. 2. USD for A?" = 4 symmetric coherent states. The 
thick solid curve gives the optimum success probability , 
the dotted curve corresponds to a simple beamsplitter mea- 
surement Pj^g, and the dashed curve describes a more compli- 
cated version of the beamsplitter setup Pgg. The thin solid 
curve gives Pp^J , corresponding to the related USD measure- 
ment on polarization (see text). 

To conclude this subsection, we consider the case where 
polarization is the degree of freedom used to encode in- 
formation. As mentioned before, the quantum states of 
the signals are mixed states. More precisely, the 4 signal 
states can be represented by density matrices of the form 

Pk = J ^\a/V2e^^){a/V2e'*\ 

(»|a/V2e*(^+'^''))(Q/V2e*('^+^'=)|, (18) 

with (f)k — 27rfc/4 for k — . . .3 and where the two modes 
correspond to two orthogonal polarizations. One could 
say the phase of the signal states is defined relative to 
a reference pulse of amplitude a 1^/2 with the effective 
signal states having the same amplitude. 

The measurement procedure for phase encoding con- 
sidered above requires for the first two photodetection 
events only reference pulses of the same amplitude as the 
signal. This part of the procedure thus carries directly 
over to the polarization case. It is only for the detection 
of the third photon, the part completing the USD mea- 
surement, that one needs to know the absolute phase of 
the signal states. This part, therefore, cannot be used for 
the polarization case. Instead, Ref. Q gives an ingenious 
argument to derive the optimum USD measurement for 
this case: produce a state |a) of a mode with polariza- 
tion e orthogonal to that of the unknown state (call it 
e'). The combined state can be written as a coherent 
state with amplitude \/2a with an unknown polariza- 
tion (e-|-e"^e')/-\/2- Then perform a non-demolition mea- 
surement of the photon number in that state and then 
perform the optimum USD measurement of polarization 
given the number of photons found. Such a measurement 
only exists when one found 3 or more photons and the 



4 



resulting probability of successful discrimination between 
the 4 phases is 



(4) 



1 



-2|q|- 



2 sinh(V2|a|2) + 2 cosh(%/2|a| 



1 



(19) 

which is plotted in Fig. ^. Since this measurement would 
require a quantum-non-demolition measurement of pho- 
ton number and an unspecified optimum USD measure- 
ment of polarization on Fock states it may not be imple- 
mented using just linear optics and photodetectors. 



E. TV > 4 



It i s easy to gener alize the simple schemes of Subsec- 
tions 
state 



Illd an d |III D| to iV > 4. Make N copies of the 
^/VN) and test each of them for one of the 



\ae 



phases (j)k = 27rfc/7V. The probability to detect at least 
one photon in — 1 of those measurements is 



^BS — 



N-1 



fc=l 



For small |ap this expression reduces to [Ol 



(TV) 



BS 



\2(N-l) 
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k=l 
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The optimal USD probability scales as 



P 



(N) 



N\( 



|2(JV-1) 



(iV-1)! 



(20) 
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This shows that the simple scheme is far from optimal 
for large N: For small amplitudes a the ratio of the two 



probabilities scales as PbP / Pjj^^ 



oc e 



-N 



for large N. 



One straighforward generalization of the more compli- 
cated beamsplitter schemes of the previous subsections 
consists of first making M copies of \ae^'^/^/M), then 
use N phase elimination setups until one of those setups 
detects a photon after which the remaining — 1 phases 
are tested, etc. Define 9m to be the phase eliminated at 
the mth step. With the further definitions 

Am = - IP 



_ M-E,r/(jv-j + i)fc, 

" N-m+l 
the probability to succeed in USD is then 

E E--E-- E 



(23) 



{ei}=Tr{0i} fci=0 fc,„=0 fe„_i=0 
g-fc„|a|^A>„/Af _ g-A,„|a|VA/j (24) 



where the first summation is over all the {N—l) \ different 
orders the phases = 1,2 . . . (N—l) can be eliminated. 
This expression is not easy to evaluate analytically, but 
for small \a\ we can expand in powers of jaj and evalu- 
ate the lowest-order nontrivial term. Starting from the 
last summation over /cat-i and working backwards to the 
summation over fci we note that each summation gives 
rise to a factor 



n 



M 



(25) 



at the nth step. The final summation then yields another 
factor s^^^ — (M / N)^ ~^ and not forgetting the factor 
(iV — 1)! for the summation over all permutations of A^ — 1 
phases, finally leads to 



N-l 



|2(JV-1) 



(iV-1)! 



(26) 



Comparing this expression with (|2^) we see that this is 
in fact optimal for small a for any A'^. 



IV. CONCLUSIONS 

We presented linear-optics implementations of unam- 
biguous state discrimination measurements on A^ sym- 
metric coherent states, that is, coherent states with 
known amplitude a but an unknown phase chosen from 
one of A^ equidistant values in the interval [0,27r). We 
discussed very simple but sub-optimal schemes for the 
cases of A^ = 2, 3, 4 that can be very easily implemented, 
and we extended these to more complicated schemes re- 
quiring feedback that are optimal ||lj] for small amplitude 
coherent states, the relevant limit for optical implemen- 
tations of Quantum Cryptography. 

Indeed, the set-up for A^ = 4 can be fruitfully used by 
the receiving end in a BB84 |^ Quantum Key Distribu- 
tion protocol with faint laser pulses. When polarization 
encodes the information only part of the protocol can be 
used, when phase encdoing is used the full procedure ap- 
plies. If three photons in total are detected, the protocol 
is in fact a USD measurement, if only two photons are 
detected the receiver will know the bit sent by the sender 
in 50% of the cases without having to exchange any ba- 
sis information. If only a single photon is detected, the 
measurement is equivalent to the standard one required 
in a single-photon implementation of the BB84 protocol. 
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